44 files changed, 265 insertions, 171 deletions
diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c
index 5f27f8e30254..f1f2f7bb6661 100644
--- a/net/8021q/vlan_core.c
+++ b/net/8021q/vlan_core.c
@@ -167,6 +167,8 @@ struct sk_buff *vlan_untag(struct sk_buff *skb)
        if (unlikely(!skb))
                goto err_free;
+        skb_reset_network_header(skb);
+        skb_reset_transport_header(skb);
        return skb;
 err_free:
diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index 175b5135bdcf..e317583fcc73 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -263,7 +263,6 @@ p9_virtio_request(struct p9_client *client, struct p9_req_t *req)
 {
        int in, out, inp, outp;
        struct virtio_chan *chan = client->trans;
-        char *rdata = (char *)req->rc+sizeof(struct p9_fcall);
        unsigned long flags;
        size_t pdata_off = 0;
        struct trans_rpage_info *rpinfo = NULL;
@@ -346,7 +345,8 @@ req_retry_pinned:
                 * Arrange in such a way that server places header in the
                 * alloced memory and payload onto the user buffer.
                 */
-                inp = pack_sg_list(chan->sg, out, VIRTQUEUE_NUM, rdata, 11);
+                inp = pack_sg_list(chan->sg, out,
+                                   VIRTQUEUE_NUM, req->rc->sdata, 11);
                /*
                 * Running executables in the filesystem may result in
                 * a read request with kernel buffer as opposed to user buffer.
@@ -366,8 +366,8 @@ req_retry_pinned:
                }
                in += inp;
        } else {
-                in = pack_sg_list(chan->sg, out, VIRTQUEUE_NUM, rdata,
+                in = pack_sg_list(chan->sg, out, VIRTQUEUE_NUM,
-                                req->rc->capacity);
+                                  req->rc->sdata, req->rc->capacity);
        }
        err = virtqueue_add_buf(chan->vq, chan->sg, out, in, req->tc);
@@ -592,7 +592,14 @@ static struct p9_trans_module p9_virtio_trans = {
        .close = p9_virtio_close,
        .request = p9_virtio_request,
        .cancel = p9_virtio_cancel,
-        .maxsize = PAGE_SIZE*VIRTQUEUE_NUM,
+        /*
+         * We leave one entry for input and one entry for response
+         * headers. We also skip one more entry to accomodate, address
+         * that are not at page boundary, that can result in an extra
+         * page in zero copy.
+         */
+        .maxsize = PAGE_SIZE * (VIRTQUEUE_NUM - 3),
        .pref = P9_TRANS_PREF_PAYLOAD_SEP,
        .def = 0,
        .owner = THIS_MODULE,
diff --git a/net/atm/br2684.c b/net/atm/br2684.c
index 52cfd0c3ea71..d07223c834af 100644
--- a/net/atm/br2684.c
+++ b/net/atm/br2684.c
@@ -558,12 +558,13 @@ static int br2684_regvcc(struct atm_vcc *atmvcc, void __user * arg)
        spin_unlock_irqrestore(&rq->lock, flags);
        skb_queue_walk_safe(&queue, skb, tmp) {
-                struct net_device *dev = skb->dev;
+                struct net_device *dev;
+                br2684_push(atmvcc, skb);
+                dev = skb->dev;
                dev->stats.rx_bytes -= skb->len;
                dev->stats.rx_packets--;
-                br2684_push(atmvcc, skb);
        }
        /* initialize netdev carrier state */
diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index 8add9b499912..117e0d161780 100644
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -494,9 +494,8 @@ int bt_sock_wait_state(struct sock *sk, int state, unsigned long timeo)
        BT_DBG("sk %p", sk);
        add_wait_queue(sk_sleep(sk), &wait);
+        set_current_state(TASK_INTERRUPTIBLE);
        while (sk->sk_state != state) {
-                set_current_state(TASK_INTERRUPTIBLE);
                if (!timeo) {
                        err = -EINPROGRESS;
                        break;
@@ -510,12 +509,13 @@ int bt_sock_wait_state(struct sock *sk, int state, unsigned long timeo)
                release_sock(sk);
                timeo = schedule_timeout(timeo);
                lock_sock(sk);
+                set_current_state(TASK_INTERRUPTIBLE);
                err = sock_error(sk);
                if (err)
                        break;
        }
-        set_current_state(TASK_RUNNING);
+        __set_current_state(TASK_RUNNING);
        remove_wait_queue(sk_sleep(sk), &wait);
        return err;
 }
diff --git a/net/bluetooth/bnep/bnep.h b/net/bluetooth/bnep/bnep.h
index 8e6c06158f8e..e7ee5314f39a 100644
--- a/net/bluetooth/bnep/bnep.h
+++ b/net/bluetooth/bnep/bnep.h
@@ -155,6 +155,7 @@ struct bnep_session {
        unsigned int  role;
        unsigned long state;
        unsigned long flags;
+        atomic_t      terminate;
        struct task_struct *task;
        struct ethhdr eh;
diff --git a/net/bluetooth/bnep/core.c b/net/bluetooth/bnep/core.c
index ca39fcf010ce..d9edfe8bf9d6 100644
--- a/net/bluetooth/bnep/core.c
+++ b/net/bluetooth/bnep/core.c
@@ -484,9 +484,11 @@ static int bnep_session(void *arg)
        init_waitqueue_entry(&wait, current);
        add_wait_queue(sk_sleep(sk), &wait);
-        while (!kthread_should_stop()) {
+        while (1) {
                set_current_state(TASK_INTERRUPTIBLE);
+                if (atomic_read(&s->terminate))
+                        break;
                /* RX */
                while ((skb = skb_dequeue(&sk->sk_receive_queue))) {
                        skb_orphan(skb);
@@ -504,7 +506,7 @@ static int bnep_session(void *arg)
                schedule();
        }
-        set_current_state(TASK_RUNNING);
+        __set_current_state(TASK_RUNNING);
        remove_wait_queue(sk_sleep(sk), &wait);
        /* Cleanup session */
@@ -640,9 +642,10 @@ int bnep_del_connection(struct bnep_conndel_req *req)
        down_read(&bnep_session_sem);
        s = __bnep_get_session(req->dst);
-        if (s)
+        if (s) {
-                kthread_stop(s->task);
+                atomic_inc(&s->terminate);
-        else
+                wake_up_process(s->task);
+        } else
                err = -ENOENT;
        up_read(&bnep_session_sem);
diff --git a/net/bluetooth/cmtp/capi.c b/net/bluetooth/cmtp/capi.c
index 040f67b12978..50f0d135eb8f 100644
--- a/net/bluetooth/cmtp/capi.c
+++ b/net/bluetooth/cmtp/capi.c
@@ -386,7 +386,8 @@ static void cmtp_reset_ctr(struct capi_ctr *ctrl)
        capi_ctr_down(ctrl);
-        kthread_stop(session->task);
+        atomic_inc(&session->terminate);
+        wake_up_process(session->task);
 }
 static void cmtp_register_appl(struct capi_ctr *ctrl, __u16 appl, capi_register_params *rp)
diff --git a/net/bluetooth/cmtp/cmtp.h b/net/bluetooth/cmtp/cmtp.h
index db43b54ac9af..c32638dddbf9 100644
--- a/net/bluetooth/cmtp/cmtp.h
+++ b/net/bluetooth/cmtp/cmtp.h
@@ -81,6 +81,7 @@ struct cmtp_session {
        char name[BTNAMSIZ];
+        atomic_t terminate;
        struct task_struct *task;
        wait_queue_head_t wait;
diff --git a/net/bluetooth/cmtp/core.c b/net/bluetooth/cmtp/core.c
index c5b11af908be..521baa4fe835 100644
--- a/net/bluetooth/cmtp/core.c
+++ b/net/bluetooth/cmtp/core.c
@@ -292,9 +292,11 @@ static int cmtp_session(void *arg)
        init_waitqueue_entry(&wait, current);
        add_wait_queue(sk_sleep(sk), &wait);
-        while (!kthread_should_stop()) {
+        while (1) {
                set_current_state(TASK_INTERRUPTIBLE);
+                if (atomic_read(&session->terminate))
+                        break;
                if (sk->sk_state != BT_CONNECTED)
                        break;
@@ -307,7 +309,7 @@ static int cmtp_session(void *arg)
                schedule();
        }
-        set_current_state(TASK_RUNNING);
+        __set_current_state(TASK_RUNNING);
        remove_wait_queue(sk_sleep(sk), &wait);
        down_write(&cmtp_session_sem);
@@ -380,16 +382,17 @@ int cmtp_add_connection(struct cmtp_connadd_req *req, struct socket *sock)
        if (!(session->flags & (1 << CMTP_LOOPBACK))) {
                err = cmtp_attach_device(session);
-                if (err < 0)
+                if (err < 0) {
-                        goto detach;
+                        atomic_inc(&session->terminate);
+                        wake_up_process(session->task);
+                        up_write(&cmtp_session_sem);
+                        return err;
+                }
        }
        up_write(&cmtp_session_sem);
        return 0;
-detach:
-        cmtp_detach_device(session);
 unlink:
        __cmtp_unlink_session(session);
@@ -414,7 +417,8 @@ int cmtp_del_connection(struct cmtp_conndel_req *req)
                skb_queue_purge(&session->transmit);
                /* Stop session thread */
-                kthread_stop(session->task);
+                atomic_inc(&session->terminate);
+                wake_up_process(session->task);
        } else
                err = -ENOENT;
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index ec0bc3f60f2e..56943add45cc 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -1209,7 +1209,6 @@ static void hci_cmd_timer(unsigned long arg)
        BT_ERR("%s command tx timeout", hdev->name);
        atomic_set(&hdev->cmd_cnt, 1);
-        clear_bit(HCI_RESET, &hdev->flags);
        tasklet_schedule(&hdev->cmd_task);
 }
@@ -1327,7 +1326,7 @@ int hci_blacklist_add(struct hci_dev *hdev, bdaddr_t *bdaddr)
        entry = kzalloc(sizeof(struct bdaddr_list), GFP_KERNEL);
        if (!entry) {
-                return -ENOMEM;
+                err = -ENOMEM;
                goto err;
        }
@@ -2408,7 +2407,10 @@ static void hci_cmd_task(unsigned long arg)
                if (hdev->sent_cmd) {
                        atomic_dec(&hdev->cmd_cnt);
                        hci_send_frame(skb);
-                        mod_timer(&hdev->cmd_timer,
+                        if (test_bit(HCI_RESET, &hdev->flags))
+                                del_timer(&hdev->cmd_timer);
+                        else
+                                mod_timer(&hdev->cmd_timer,
                                  jiffies + msecs_to_jiffies(HCI_CMD_TIMEOUT));
                } else {
                        skb_queue_head(&hdev->cmd_q, skb);
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index 43b4c2deb7cc..fb68f344c34a 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -764,6 +764,7 @@ static int hidp_session(void *arg)
        up_write(&hidp_session_sem);
+        kfree(session->rd_data);
        kfree(session);
        return 0;
 }
@@ -841,7 +842,8 @@ static int hidp_setup_input(struct hidp_session *session,
        err = input_register_device(input);
        if (err < 0) {
-                hci_conn_put_device(session->conn);
+                input_free_device(input);
+                session->input = NULL;
                return err;
        }
@@ -1044,8 +1046,12 @@ int hidp_add_connection(struct hidp_connadd_req *req, struct socket *ctrl_sock,
        }
        err = hid_add_device(session->hid);
-        if (err < 0)
+        if (err < 0) {
-                goto err_add_device;
+                atomic_inc(&session->terminate);
+                wake_up_process(session->task);
+                up_write(&hidp_session_sem);
+                return err;
+        }
        if (session->input) {
                hidp_send_ctrl_message(session,
@@ -1059,12 +1065,6 @@ int hidp_add_connection(struct hidp_connadd_req *req, struct socket *ctrl_sock,
        up_write(&hidp_session_sem);
        return 0;
-err_add_device:
-        hid_destroy_device(session->hid);
-        session->hid = NULL;
-        atomic_inc(&session->terminate);
-        wake_up_process(session->task);
 unlink:
        hidp_del_timer(session);
@@ -1090,7 +1090,6 @@ purge:
 failed:
        up_write(&hidp_session_sem);
-        input_free_device(session->input);
        kfree(session);
        return err;
 }
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 3204ba8a701c..b3bdb482bbe6 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -1159,9 +1159,8 @@ int __l2cap_wait_ack(struct sock *sk)
        int timeo = HZ/5;
        add_wait_queue(sk_sleep(sk), &wait);
-        while ((chan->unacked_frames > 0 && chan->conn)) {
+        set_current_state(TASK_INTERRUPTIBLE);
-                set_current_state(TASK_INTERRUPTIBLE);
+        while (chan->unacked_frames > 0 && chan->conn) {
                if (!timeo)
                        timeo = HZ/5;
@@ -1173,6 +1172,7 @@ int __l2cap_wait_ack(struct sock *sk)
                release_sock(sk);
                timeo = schedule_timeout(timeo);
                lock_sock(sk);
+                set_current_state(TASK_INTERRUPTIBLE);
                err = sock_error(sk);
                if (err)
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index 5c36b3e8739c..61f1f623091d 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -235,30 +235,26 @@ static int l2cap_sock_accept(struct socket *sock, struct socket *newsock, int fl
        lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
-        if (sk->sk_state != BT_LISTEN) {
-                err = -EBADFD;
-                goto done;
-        }
        timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
        BT_DBG("sk %p timeo %ld", sk, timeo);
        /* Wait for an incoming connection. (wake-one). */
        add_wait_queue_exclusive(sk_sleep(sk), &wait);
-        while (!(nsk = bt_accept_dequeue(sk, newsock))) {
+        while (1) {
                set_current_state(TASK_INTERRUPTIBLE);
-                if (!timeo) {
-                        err = -EAGAIN;
+                if (sk->sk_state != BT_LISTEN) {
+                        err = -EBADFD;
                        break;
                }
-                release_sock(sk);
+                nsk = bt_accept_dequeue(sk, newsock);
-                timeo = schedule_timeout(timeo);
+                if (nsk)
-                lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
+                        break;
-                if (sk->sk_state != BT_LISTEN) {
+                if (!timeo) {
-                        err = -EBADFD;
+                        err = -EAGAIN;
                        break;
                }
@@ -266,8 +262,12 @@ static int l2cap_sock_accept(struct socket *sock, struct socket *newsock, int fl
                        err = sock_intr_errno(timeo);
                        break;
                }
+                release_sock(sk);
+                timeo = schedule_timeout(timeo);
+                lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
        }
-        set_current_state(TASK_RUNNING);
+        __set_current_state(TASK_RUNNING);
        remove_wait_queue(sk_sleep(sk), &wait);
        if (err)
@@ -993,7 +993,7 @@ static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, int p
        INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
        sk->sk_destruct = l2cap_sock_destruct;
-        sk->sk_sndtimeo = msecs_to_jiffies(L2CAP_CONN_TIMEOUT);
+        sk->sk_sndtimeo = L2CAP_CONN_TIMEOUT;
        sock_reset_flag(sk, SOCK_ZAPPED);
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index 5759bb7054f7..5ba3f6df665c 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -62,7 +62,6 @@ static DEFINE_MUTEX(rfcomm_mutex);
 #define rfcomm_lock()   mutex_lock(&rfcomm_mutex)
 #define rfcomm_unlock() mutex_unlock(&rfcomm_mutex)
-static unsigned long rfcomm_event;
 static LIST_HEAD(session_list);
@@ -120,7 +119,6 @@ static inline void rfcomm_schedule(void)
 {
        if (!rfcomm_thread)
                return;
-        set_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event);
        wake_up_process(rfcomm_thread);
 }
@@ -2038,19 +2036,18 @@ static int rfcomm_run(void *unused)
        rfcomm_add_listener(BDADDR_ANY);
-        while (!kthread_should_stop()) {
+        while (1) {
                set_current_state(TASK_INTERRUPTIBLE);
-                if (!test_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event)) {
-                        /* No pending events. Let's sleep.
+                if (kthread_should_stop())
-                         * Incoming connections and data will wake us up. */
+                        break;
-                        schedule();
-                }
-                set_current_state(TASK_RUNNING);
                /* Process stuff */
-                clear_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event);
                rfcomm_process_sessions();
+                schedule();
        }
+        __set_current_state(TASK_RUNNING);
        rfcomm_kill_listener();
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index 8f01e6b11a70..482722bbc7a0 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -485,11 +485,6 @@ static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, int f
        lock_sock(sk);
-        if (sk->sk_state != BT_LISTEN) {
-                err = -EBADFD;
-                goto done;
-        }
        if (sk->sk_type != SOCK_STREAM) {
                err = -EINVAL;
                goto done;
@@ -501,19 +496,20 @@ static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, int f
        /* Wait for an incoming connection. (wake-one). */
        add_wait_queue_exclusive(sk_sleep(sk), &wait);
-        while (!(nsk = bt_accept_dequeue(sk, newsock))) {
+        while (1) {
                set_current_state(TASK_INTERRUPTIBLE);
-                if (!timeo) {
-                        err = -EAGAIN;
+                if (sk->sk_state != BT_LISTEN) {
+                        err = -EBADFD;
                        break;
                }
-                release_sock(sk);
+                nsk = bt_accept_dequeue(sk, newsock);
-                timeo = schedule_timeout(timeo);
+                if (nsk)
-                lock_sock(sk);
+                        break;
-                if (sk->sk_state != BT_LISTEN) {
+                if (!timeo) {
-                        err = -EBADFD;
+                        err = -EAGAIN;
                        break;
                }
@@ -521,8 +517,12 @@ static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, int f
                        err = sock_intr_errno(timeo);
                        break;
                }
+                release_sock(sk);
+                timeo = schedule_timeout(timeo);
+                lock_sock(sk);
        }
-        set_current_state(TASK_RUNNING);
+        __set_current_state(TASK_RUNNING);
        remove_wait_queue(sk_sleep(sk), &wait);
        if (err)
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 4c3621b5e0aa..8270f05e3f1f 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -564,30 +564,26 @@ static int sco_sock_accept(struct socket *sock, struct socket *newsock, int flag
        lock_sock(sk);
-        if (sk->sk_state != BT_LISTEN) {
-                err = -EBADFD;
-                goto done;
-        }
        timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
        BT_DBG("sk %p timeo %ld", sk, timeo);
        /* Wait for an incoming connection. (wake-one). */
        add_wait_queue_exclusive(sk_sleep(sk), &wait);
-        while (!(ch = bt_accept_dequeue(sk, newsock))) {
+        while (1) {
                set_current_state(TASK_INTERRUPTIBLE);
-                if (!timeo) {
-                        err = -EAGAIN;
+                if (sk->sk_state != BT_LISTEN) {
+                        err = -EBADFD;
                        break;
                }
-                release_sock(sk);
+                ch = bt_accept_dequeue(sk, newsock);
-                timeo = schedule_timeout(timeo);
+                if (ch)
-                lock_sock(sk);
+                        break;
-                if (sk->sk_state != BT_LISTEN) {
+                if (!timeo) {
-                        err = -EBADFD;
+                        err = -EAGAIN;
                        break;
                }
@@ -595,8 +591,12 @@ static int sco_sock_accept(struct socket *sock, struct socket *newsock, int flag
                        err = sock_intr_errno(timeo);
                        break;
                }
+                release_sock(sk);
+                timeo = schedule_timeout(timeo);
+                lock_sock(sk);
        }
-        set_current_state(TASK_RUNNING);
+        __set_current_state(TASK_RUNNING);
        remove_wait_queue(sk_sleep(sk), &wait);
        if (err)
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index 3176e2e13d9b..e73815456adf 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -231,6 +231,7 @@ static struct net_bridge_port *new_nbp(struct net_bridge *br,
 int br_add_bridge(struct net *net, const char *name)
 {
        struct net_device *dev;
+        int res;
        dev = alloc_netdev(sizeof(struct net_bridge), name,
                           br_dev_setup);
@@ -240,7 +241,10 @@ int br_add_bridge(struct net *net, const char *name)
        dev_net_set(dev, net);
-        return register_netdev(dev);
+        res = register_netdev(dev);
+        if (res)
+                free_netdev(dev);
+        return res;
 }
 int br_del_bridge(struct net *net, const char *name)
@@ -417,6 +421,7 @@ put_back:
 int br_del_if(struct net_bridge *br, struct net_device *dev)
 {
        struct net_bridge_port *p;
+        bool changed_addr;
        p = br_port_get_rtnl(dev);
        if (!p || p->br != br)
@@ -425,9 +430,12 @@ int br_del_if(struct net_bridge *br, struct net_device *dev)
        del_nbp(p);
        spin_lock_bh(&br->lock);
-        br_stp_recalculate_bridge_id(br);
+        changed_addr = br_stp_recalculate_bridge_id(br);
        spin_unlock_bh(&br->lock);
+        if (changed_addr)
+                call_netdevice_notifiers(NETDEV_CHANGEADDR, br->dev);
        netdev_update_features(br->dev);
        return 0;
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 2d85ca7111d3..995cbe0ac0b2 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -1456,7 +1456,7 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
 {
        struct sk_buff *skb2;
        const struct ipv6hdr *ip6h;
-        struct icmp6hdr *icmp6h;
+        u8 icmp6_type;
        u8 nexthdr;
        unsigned len;
        int offset;
@@ -1502,9 +1502,9 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
        __skb_pull(skb2, offset);
        skb_reset_transport_header(skb2);
-        icmp6h = icmp6_hdr(skb2);
+        icmp6_type = icmp6_hdr(skb2)->icmp6_type;
-        switch (icmp6h->icmp6_type) {
+        switch (icmp6_type) {
        case ICMPV6_MGM_QUERY:
        case ICMPV6_MGM_REPORT:
        case ICMPV6_MGM_REDUCTION:
@@ -1520,16 +1520,23 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
                err = pskb_trim_rcsum(skb2, len);
                if (err)
                        goto out;
+                err = -EINVAL;
        }
+        ip6h = ipv6_hdr(skb2);
        switch (skb2->ip_summed) {
        case CHECKSUM_COMPLETE:
-                if (!csum_fold(skb2->csum))
+                if (!csum_ipv6_magic(&ip6h->saddr, &ip6h->daddr, skb2->len,
+                                        IPPROTO_ICMPV6, skb2->csum))
                        break;
                /*FALLTHROUGH*/
        case CHECKSUM_NONE:
-                skb2->csum = 0;
+                skb2->csum = ~csum_unfold(csum_ipv6_magic(&ip6h->saddr,
-                if (skb_checksum_complete(skb2))
+                                                        &ip6h->daddr,
+                                                        skb2->len,
+                                                        IPPROTO_ICMPV6, 0));
+                if (__skb_checksum_complete(skb2))
                        goto out;
        }
@@ -1537,7 +1544,7 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
        BR_INPUT_SKB_CB(skb)->igmp = 1;
-        switch (icmp6h->icmp6_type) {
+        switch (icmp6_type) {
        case ICMPV6_MGM_REPORT:
            {
                struct mld_msg *mld;
diff --git a/net/bridge/br_notify.c b/net/bridge/br_notify.c
index 6545ee9591d1..a76b62135558 100644
--- a/net/bridge/br_notify.c
+++ b/net/bridge/br_notify.c
@@ -34,6 +34,7 @@ static int br_device_event(struct notifier_block *unused, unsigned long event, v
        struct net_device *dev = ptr;
        struct net_bridge_port *p;
        struct net_bridge *br;
+        bool changed_addr;
        int err;
        /* register of bridge completed, add sysfs entries */
@@ -57,8 +58,12 @@ static int br_device_event(struct notifier_block *unused, unsigned long event, v
        case NETDEV_CHANGEADDR:
                spin_lock_bh(&br->lock);
                br_fdb_changeaddr(p, dev->dev_addr);
-                br_stp_recalculate_bridge_id(br);
+                changed_addr = br_stp_recalculate_bridge_id(br);
                spin_unlock_bh(&br->lock);
+                if (changed_addr)
+                        call_netdevice_notifiers(NETDEV_CHANGEADDR, br->dev);
                break;
        case NETDEV_CHANGE:
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 2b5ca1a0054d..5864cc491369 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -1198,7 +1198,8 @@ ebt_register_table(struct net *net, const struct ebt_table *input_table)
        if (table->check && table->check(newinfo, table->valid_hooks)) {
                BUGPRINT("The table doesn't like its own initial data, lol\n");
-                return ERR_PTR(-EINVAL);
+                ret = -EINVAL;
+                goto free_chainstack;
        }
        table->private = newinfo;
diff --git a/net/ceph/msgpool.c b/net/ceph/msgpool.c
index d5f2d97ac05c..1f4cb30a42c5 100644
--- a/net/ceph/msgpool.c
+++ b/net/ceph/msgpool.c
@@ -7,27 +7,37 @@
 #include <linux/ceph/msgpool.h>
-static void *alloc_fn(gfp_t gfp_mask, void *arg)
+static void *msgpool_alloc(gfp_t gfp_mask, void *arg)
 {
        struct ceph_msgpool *pool = arg;
-        void *p;
+        struct ceph_msg *msg;
-        p = ceph_msg_new(0, pool->front_len, gfp_mask);
+        msg = ceph_msg_new(0, pool->front_len, gfp_mask);
-        if (!p)
+        if (!msg) {
-                pr_err("msgpool %s alloc failed\n", pool->name);
+                dout("msgpool_alloc %s failed\n", pool->name);
-        return p;
+        } else {
+                dout("msgpool_alloc %s %p\n", pool->name, msg);
+                msg->pool = pool;
+        }
+        return msg;
 }
-static void free_fn(void *element, void *arg)
+static void msgpool_free(void *element, void *arg)
 {
-        ceph_msg_put(element);
+        struct ceph_msgpool *pool = arg;
+        struct ceph_msg *msg = element;
+        dout("msgpool_release %s %p\n", pool->name, msg);
+        msg->pool = NULL;
+        ceph_msg_put(msg);
 }
 int ceph_msgpool_init(struct ceph_msgpool *pool,
                      int front_len, int size, bool blocking, const char *name)
 {
+        dout("msgpool %s init\n", name);
        pool->front_len = front_len;
-        pool->pool = mempool_create(size, alloc_fn, free_fn, pool);
+        pool->pool = mempool_create(size, msgpool_alloc, msgpool_free, pool);
        if (!pool->pool)
                return -ENOMEM;
        pool->name = name;
@@ -36,14 +46,17 @@ int ceph_msgpool_init(struct ceph_msgpool *pool,
 void ceph_msgpool_destroy(struct ceph_msgpool *pool)
 {
+        dout("msgpool %s destroy\n", pool->name);
        mempool_destroy(pool->pool);
 }
 struct ceph_msg *ceph_msgpool_get(struct ceph_msgpool *pool,
                                  int front_len)
 {
+        struct ceph_msg *msg;
        if (front_len > pool->front_len) {
-                pr_err("msgpool_get pool %s need front %d, pool size is %d\n",
+                dout("msgpool_get %s need front %d, pool size is %d\n",
                       pool->name, front_len, pool->front_len);
                WARN_ON(1);
@@ -51,14 +64,19 @@ struct ceph_msg *ceph_msgpool_get(struct ceph_msgpool *pool,
                return ceph_msg_new(0, front_len, GFP_NOFS);
        }
-        return mempool_alloc(pool->pool, GFP_NOFS);
+        msg = mempool_alloc(pool->pool, GFP_NOFS);
+        dout("msgpool_get %s %p\n", pool->name, msg);
+        return msg;
 }
 void ceph_msgpool_put(struct ceph_msgpool *pool, struct ceph_msg *msg)
 {
+        dout("msgpool_put %s %p\n", pool->name, msg);
        /* reset msg front_len; user may have changed it */
        msg->front.iov_len = pool->front_len;
        msg->hdr.front_len = cpu_to_le32(pool->front_len);
        kref_init(&msg->kref);  /* retake single ref */
+        mempool_free(msg, pool->pool);
 }
diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
index ce310eee708d..16836a7df7a6 100644
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
@@ -685,6 +685,18 @@ static void __remove_osd(struct ceph_osd_client *osdc, struct ceph_osd *osd)
        put_osd(osd);
 }
+static void remove_all_osds(struct ceph_osd_client *osdc)
+{
+        dout("__remove_old_osds %p\n", osdc);
+        mutex_lock(&osdc->request_mutex);
+        while (!RB_EMPTY_ROOT(&osdc->osds)) {
+                struct ceph_osd *osd = rb_entry(rb_first(&osdc->osds),
+                                                struct ceph_osd, o_node);
+                __remove_osd(osdc, osd);
+        }
+        mutex_unlock(&osdc->request_mutex);
+}
 static void __move_osd_to_lru(struct ceph_osd_client *osdc,
                              struct ceph_osd *osd)
 {
@@ -701,14 +713,14 @@ static void __remove_osd_from_lru(struct ceph_osd *osd)
                list_del_init(&osd->o_osd_lru);
 }
-static void remove_old_osds(struct ceph_osd_client *osdc, int remove_all)
+static void remove_old_osds(struct ceph_osd_client *osdc)
 {
        struct ceph_osd *osd, *nosd;
        dout("__remove_old_osds %p\n", osdc);
        mutex_lock(&osdc->request_mutex);
        list_for_each_entry_safe(osd, nosd, &osdc->osd_lru, o_osd_lru) {
-                if (!remove_all && time_before(jiffies, osd->lru_ttl))
+                if (time_before(jiffies, osd->lru_ttl))
                        break;
                __remove_osd(osdc, osd);
        }
@@ -751,6 +763,7 @@ static void __insert_osd(struct ceph_osd_client *osdc, struct ceph_osd *new)
        struct rb_node *parent = NULL;
        struct ceph_osd *osd = NULL;
+        dout("__insert_osd %p osd%d\n", new, new->o_osd);
        while (*p) {
                parent = *p;
                osd = rb_entry(parent, struct ceph_osd, o_node);
@@ -1144,7 +1157,7 @@ static void handle_osds_timeout(struct work_struct *work)
        dout("osds timeout\n");
        down_read(&osdc->map_sem);
-        remove_old_osds(osdc, 0);
+        remove_old_osds(osdc);
        up_read(&osdc->map_sem);
        schedule_delayed_work(&osdc->osds_timeout_work,
@@ -1862,8 +1875,7 @@ void ceph_osdc_stop(struct ceph_osd_client *osdc)
                ceph_osdmap_destroy(osdc->osdmap);
                osdc->osdmap = NULL;
        }
-        remove_old_osds(osdc, 1);
+        remove_all_osds(osdc);
-        WARN_ON(!RB_EMPTY_ROOT(&osdc->osds));
        mempool_destroy(osdc->req_mempool);
        ceph_msgpool_destroy(&osdc->msgpool_op);
        ceph_msgpool_destroy(&osdc->msgpool_op_reply);
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 8fab9b0bb203..1334d7e56f02 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -1319,11 +1319,15 @@ static void neigh_proxy_process(unsigned long arg)
                if (tdif <= 0) {
                        struct net_device *dev = skb->dev;
                        __skb_unlink(skb, &tbl->proxy_queue);
-                        if (tbl->proxy_redo && netif_running(dev))
+                        if (tbl->proxy_redo && netif_running(dev)) {
+                                rcu_read_lock();
                                tbl->proxy_redo(skb);
-                        else
+                                rcu_read_unlock();
+                        } else {
                                kfree_skb(skb);
+                        }
                        dev_put(dev);
                } else if (!sched_next || tdif < sched_next)
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index adf84dd8c7b5..52622517e0d8 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -558,13 +558,14 @@ int __netpoll_rx(struct sk_buff *skb)
        if (skb_shared(skb))
                goto out;
-        iph = (struct iphdr *)skb->data;
        if (!pskb_may_pull(skb, sizeof(struct iphdr)))
                goto out;
+        iph = (struct iphdr *)skb->data;
        if (iph->ihl < 5 || iph->version != 4)
                goto out;
        if (!pskb_may_pull(skb, iph->ihl*4))
                goto out;
+        iph = (struct iphdr *)skb->data;
        if (ip_fast_csum((u8 *)iph, iph->ihl) != 0)
                goto out;
@@ -579,6 +580,7 @@ int __netpoll_rx(struct sk_buff *skb)
        if (pskb_trim_rcsum(skb, len))
                goto out;
+        iph = (struct iphdr *)skb->data;
        if (iph->protocol != IPPROTO_UDP)
                goto out;
diff --git a/net/core/scm.c b/net/core/scm.c
index 4c1ef026d695..811b53fb330e 100644
--- a/net/core/scm.c
+++ b/net/core/scm.c
@@ -192,7 +192,7 @@ int __scm_send(struct socket *sock, struct msghdr *msg, struct scm_cookie *p)
                                        goto error;
                                cred->uid = cred->euid = p->creds.uid;
-                                cred->gid = cred->egid = p->creds.uid;
+                                cred->gid = cred->egid = p->creds.gid;
                                put_cred(p->cred);
                                p->cred = cred;
                        }
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 283c0a26e03f..d577199eabd5 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -767,7 +767,7 @@ static int igmp_xmarksources(struct ip_mc_list *pmc, int nsrcs, __be32 *srcs)
                        break;
                for (i=0; i<nsrcs; i++) {
                        /* skip inactive filters */
-                        if (pmc->sfcount[MCAST_INCLUDE] ||
+                        if (psf->sf_count[MCAST_INCLUDE] ||
                            pmc->sfcount[MCAST_EXCLUDE] !=
                            psf->sf_count[MCAST_EXCLUDE])
                                continue;
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 77d3eded665a..8c6563361ab5 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -122,6 +122,7 @@ static int ip_dev_loopback_xmit(struct sk_buff *newskb)
        newskb->pkt_type = PACKET_LOOPBACK;
        newskb->ip_summed = CHECKSUM_UNNECESSARY;
        WARN_ON(!skb_dst(newskb));
+        skb_dst_force(newskb);
        netif_rx_ni(newskb);
        return 0;
 }
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index ab0c9efd1efa..8905e92f896a 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -1067,7 +1067,7 @@ EXPORT_SYMBOL(compat_ip_setsockopt);
 */
 static int do_ip_getsockopt(struct sock *sk, int level, int optname,
-                            char __user *optval, int __user *optlen)
+                            char __user *optval, int __user *optlen, unsigned flags)
 {
        struct inet_sock *inet = inet_sk(sk);
        int val;
@@ -1240,7 +1240,7 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
                msg.msg_control = optval;
                msg.msg_controllen = len;
-                msg.msg_flags = 0;
+                msg.msg_flags = flags;
                if (inet->cmsg_flags & IP_CMSG_PKTINFO) {
                        struct in_pktinfo info;
@@ -1294,7 +1294,7 @@ int ip_getsockopt(struct sock *sk, int level,
 {
        int err;
-        err = do_ip_getsockopt(sk, level, optname, optval, optlen);
+        err = do_ip_getsockopt(sk, level, optname, optval, optlen, 0);
 #ifdef CONFIG_NETFILTER
        /* we need to exclude all possible ENOPROTOOPTs except default case */
        if (err == -ENOPROTOOPT && optname != IP_PKTOPTIONS &&
@@ -1327,7 +1327,8 @@ int compat_ip_getsockopt(struct sock *sk, int level, int optname,
                return compat_mc_getsockopt(sk, level, optname, optval, optlen,
                        ip_getsockopt);
-        err = do_ip_getsockopt(sk, level, optname, optval, optlen);
+        err = do_ip_getsockopt(sk, level, optname, optval, optlen,
+                MSG_CMSG_COMPAT);
 #ifdef CONFIG_NETFILTER
        /* we need to exclude all possible ENOPROTOOPTs except default case */
diff --git a/net/ipv4/netfilter.c b/net/ipv4/netfilter.c
index 2e97e3ec1eb7..929b27bdeb79 100644
--- a/net/ipv4/netfilter.c
+++ b/net/ipv4/netfilter.c
@@ -18,17 +18,15 @@ int ip_route_me_harder(struct sk_buff *skb, unsigned addr_type)
        struct rtable *rt;
        struct flowi4 fl4 = {};
        __be32 saddr = iph->saddr;
-        __u8 flags = 0;
+        __u8 flags = skb->sk ? inet_sk_flowi_flags(skb->sk) : 0;
        unsigned int hh_len;
-        if (!skb->sk && addr_type != RTN_LOCAL) {
+        if (addr_type == RTN_UNSPEC)
-                if (addr_type == RTN_UNSPEC)
+                addr_type = inet_addr_type(net, saddr);
-                        addr_type = inet_addr_type(net, saddr);
+        if (addr_type == RTN_LOCAL || addr_type == RTN_UNICAST)
-                if (addr_type == RTN_LOCAL || addr_type == RTN_UNICAST)
+                flags |= FLOWI_FLAG_ANYSRC;
-                        flags |= FLOWI_FLAG_ANYSRC;
+        else
-                else
+                saddr = 0;
-                        saddr = 0;
-        }
        /* some non-standard hacks like ipt_REJECT.c:send_reset() can cause
         * packets with foreign saddr to appear on the NF_INET_LOCAL_OUT hook.
@@ -38,7 +36,7 @@ int ip_route_me_harder(struct sk_buff *skb, unsigned addr_type)
        fl4.flowi4_tos = RT_TOS(iph->tos);
        fl4.flowi4_oif = skb->sk ? skb->sk->sk_bound_dev_if : 0;
        fl4.flowi4_mark = skb->mark;
-        fl4.flowi4_flags = skb->sk ? inet_sk_flowi_flags(skb->sk) : flags;
+        fl4.flowi4_flags = flags;
        rt = ip_route_output_key(net, &fl4);
        if (IS_ERR(rt))
                return -1;
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 1457acb39cec..61714bd52925 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -563,7 +563,8 @@ static int raw_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
        flowi4_init_output(&fl4, ipc.oif, sk->sk_mark, tos,
                           RT_SCOPE_UNIVERSE,
                           inet->hdrincl ? IPPROTO_RAW : sk->sk_protocol,
-                           FLOWI_FLAG_CAN_SLEEP, daddr, saddr, 0, 0);
+                           inet_sk_flowi_flags(sk) | FLOWI_FLAG_CAN_SLEEP,
+                           daddr, saddr, 0, 0);
        if (!inet->hdrincl) {
                err = raw_probe_proto_opt(&fl4, msg);
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index e3dec1c9f09d..075212e41b83 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -722,7 +722,7 @@ static inline bool compare_hash_inputs(const struct rtable *rt1,
 {
        return ((((__force u32)rt1->rt_key_dst ^ (__force u32)rt2->rt_key_dst) |
                ((__force u32)rt1->rt_key_src ^ (__force u32)rt2->rt_key_src) |
-                (rt1->rt_iif ^ rt2->rt_iif)) == 0);
+                (rt1->rt_route_iif ^ rt2->rt_route_iif)) == 0);
 }
 static inline int compare_keys(struct rtable *rt1, struct rtable *rt2)
@@ -731,8 +731,8 @@ static inline int compare_keys(struct rtable *rt1, struct rtable *rt2)
                ((__force u32)rt1->rt_key_src ^ (__force u32)rt2->rt_key_src) |
                (rt1->rt_mark ^ rt2->rt_mark) |
                (rt1->rt_key_tos ^ rt2->rt_key_tos) |
-                (rt1->rt_oif ^ rt2->rt_oif) |
+                (rt1->rt_route_iif ^ rt2->rt_route_iif) |
-                (rt1->rt_iif ^ rt2->rt_iif)) == 0;
+                (rt1->rt_oif ^ rt2->rt_oif)) == 0;
 }
 static inline int compare_netns(struct rtable *rt1, struct rtable *rt2)
@@ -2320,8 +2320,7 @@ int ip_route_input_common(struct sk_buff *skb, __be32 daddr, __be32 saddr,
             rth = rcu_dereference(rth->dst.rt_next)) {
                if ((((__force u32)rth->rt_key_dst ^ (__force u32)daddr) |
                     ((__force u32)rth->rt_key_src ^ (__force u32)saddr) |
-                     (rth->rt_iif ^ iif) |
+                     (rth->rt_route_iif ^ iif) |
-                     rth->rt_oif |
                     (rth->rt_key_tos ^ tos)) == 0 &&
                    rth->rt_mark == skb->mark &&
                    net_eq(dev_net(rth->dst.dev), net) &&
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index 92bb9434b338..3bc5c8f7c71b 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -276,7 +276,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
        int mss;
        struct rtable *rt;
        __u8 rcv_wscale;
-        bool ecn_ok;
+        bool ecn_ok = false;
        if (!sysctl_tcp_syncookies || !th->ack || th->rst)
                goto out;
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 9cb191ecaba8..147ede38ab48 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -913,7 +913,7 @@ static int ipv6_getsockopt_sticky(struct sock *sk, struct ipv6_txoptions *opt,
 }
 static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
-                    char __user *optval, int __user *optlen)
+                    char __user *optval, int __user *optlen, unsigned flags)
 {
        struct ipv6_pinfo *np = inet6_sk(sk);
        int len;
@@ -962,7 +962,7 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
                msg.msg_control = optval;
                msg.msg_controllen = len;
-                msg.msg_flags = 0;
+                msg.msg_flags = flags;
                lock_sock(sk);
                skb = np->pktoptions;
@@ -1222,7 +1222,7 @@ int ipv6_getsockopt(struct sock *sk, int level, int optname,
        if(level != SOL_IPV6)
                return -ENOPROTOOPT;
-        err = do_ipv6_getsockopt(sk, level, optname, optval, optlen);
+        err = do_ipv6_getsockopt(sk, level, optname, optval, optlen, 0);
 #ifdef CONFIG_NETFILTER
        /* we need to exclude all possible ENOPROTOOPTs except default case */
        if (err == -ENOPROTOOPT && optname != IPV6_2292PKTOPTIONS) {
@@ -1264,7 +1264,8 @@ int compat_ipv6_getsockopt(struct sock *sk, int level, int optname,
                return compat_mc_getsockopt(sk, level, optname, optval, optlen,
                        ipv6_getsockopt);
-        err = do_ipv6_getsockopt(sk, level, optname, optval, optlen);
+        err = do_ipv6_getsockopt(sk, level, optname, optval, optlen,
+                                 MSG_CMSG_COMPAT);
 #ifdef CONFIG_NETFILTER
        /* we need to exclude all possible ENOPROTOOPTs except default case */
        if (err == -ENOPROTOOPT && optname != IPV6_2292PKTOPTIONS) {
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 3e6ebcdb4779..ee7839f4d6e3 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -1059,7 +1059,7 @@ static int mld_xmarksources(struct ifmcaddr6 *pmc, int nsrcs,
                        break;
                for (i=0; i<nsrcs; i++) {
                        /* skip inactive filters */
-                        if (pmc->mca_sfcount[MCAST_INCLUDE] ||
+                        if (psf->sf_count[MCAST_INCLUDE] ||
                            pmc->mca_sfcount[MCAST_EXCLUDE] !=
                            psf->sf_count[MCAST_EXCLUDE])
                                continue;
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 07bf1085458f..00b15ac7a702 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -672,6 +672,9 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
        if (skb->protocol != htons(ETH_P_IPV6))
                goto tx_error;
+        if (tos == 1)
+                tos = ipv6_get_dsfield(iph6);
        /* ISATAP (RFC4214) - must come before 6to4 */
        if (dev->priv_flags & IFF_ISATAP) {
                struct neighbour *neigh = NULL;
diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
index 89d5bf806222..ac838965ff34 100644
--- a/net/ipv6/syncookies.c
+++ b/net/ipv6/syncookies.c
@@ -165,7 +165,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
        int mss;
        struct dst_entry *dst;
        __u8 rcv_wscale;
-        bool ecn_ok;
+        bool ecn_ok = false;
        if (!sysctl_tcp_syncookies || !th->ack || th->rst)
                goto out;
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 866f269183cf..acb44230b251 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -1012,7 +1012,6 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
        cancel_work_sync(&local->reconfig_filter);
        ieee80211_clear_tx_pending(local);
-        sta_info_stop(local);
        rate_control_deinitialize(local);
        if (skb_queue_len(&local->skb_queue) ||
@@ -1024,6 +1023,7 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
        destroy_workqueue(local->workqueue);
        wiphy_unregister(local->hw.wiphy);
+        sta_info_stop(local);
        ieee80211_wep_free(local);
        ieee80211_led_exit(local);
        kfree(local->int_scan_req);
diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
index 5b466cd1272f..84d0fd47636a 100644
--- a/net/netfilter/nf_queue.c
+++ b/net/netfilter/nf_queue.c
@@ -312,6 +312,7 @@ void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict)
                }
                break;
        case NF_STOLEN:
+                break;
        default:
                kfree_skb(skb);
        }
diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c
index 58107d060846..9c24de10a657 100644
--- a/net/netlabel/netlabel_kapi.c
+++ b/net/netlabel/netlabel_kapi.c
@@ -341,11 +341,11 @@ int netlbl_cfg_cipsov4_map_add(u32 doi,
        entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
        if (entry == NULL)
-                return -ENOMEM;
+                goto out_entry;
        if (domain != NULL) {
                entry->domain = kstrdup(domain, GFP_ATOMIC);
                if (entry->domain == NULL)
-                        goto cfg_cipsov4_map_add_failure;
+                        goto out_domain;
        }
        if (addr == NULL && mask == NULL) {
@@ -354,13 +354,13 @@ int netlbl_cfg_cipsov4_map_add(u32 doi,
        } else if (addr != NULL && mask != NULL) {
                addrmap = kzalloc(sizeof(*addrmap), GFP_ATOMIC);
                if (addrmap == NULL)
-                        goto cfg_cipsov4_map_add_failure;
+                        goto out_addrmap;
                INIT_LIST_HEAD(&addrmap->list4);
                INIT_LIST_HEAD(&addrmap->list6);
                addrinfo = kzalloc(sizeof(*addrinfo), GFP_ATOMIC);
                if (addrinfo == NULL)
-                        goto cfg_cipsov4_map_add_failure;
+                        goto out_addrinfo;
                addrinfo->type_def.cipsov4 = doi_def;
                addrinfo->type = NETLBL_NLTYPE_CIPSOV4;
                addrinfo->list.addr = addr->s_addr & mask->s_addr;
@@ -374,7 +374,7 @@ int netlbl_cfg_cipsov4_map_add(u32 doi,
                entry->type = NETLBL_NLTYPE_ADDRSELECT;
        } else {
                ret_val = -EINVAL;
-                goto cfg_cipsov4_map_add_failure;
+                goto out_addrmap;
        }
        ret_val = netlbl_domhsh_add(entry, audit_info);
@@ -384,11 +384,15 @@ int netlbl_cfg_cipsov4_map_add(u32 doi,
        return 0;
 cfg_cipsov4_map_add_failure:
-        cipso_v4_doi_putdef(doi_def);
+        kfree(addrinfo);
+out_addrinfo:
+        kfree(addrmap);
+out_addrmap:
        kfree(entry->domain);
+out_domain:
        kfree(entry);
-        kfree(addrmap);
+out_entry:
-        kfree(addrinfo);
+        cipso_v4_doi_putdef(doi_def);
        return ret_val;
 }
diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
index 102fc212cd64..e051398fdf6b 100644
--- a/net/sched/act_mirred.c
+++ b/net/sched/act_mirred.c
@@ -196,8 +196,7 @@ static int tcf_mirred(struct sk_buff *skb, const struct tc_action *a,
        skb2->skb_iif = skb->dev->ifindex;
        skb2->dev = dev;
-        dev_queue_xmit(skb2);
+        err = dev_queue_xmit(skb2);
-        err = 0;
 out:
        if (err) {
diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c
index 2a318f2dc3e5..b5d56a22b1d2 100644
--- a/net/sched/sch_prio.c
+++ b/net/sched/sch_prio.c
@@ -112,7 +112,7 @@ static struct sk_buff *prio_dequeue(struct Qdisc *sch)
        for (prio = 0; prio < q->bands; prio++) {
                struct Qdisc *qdisc = q->queues[prio];
-                struct sk_buff *skb = qdisc->dequeue(qdisc);
+                struct sk_buff *skb = qdisc_dequeue_peeked(qdisc);
                if (skb) {
                        qdisc_bstats_update(sch, skb);
                        sch->q.qlen--;
diff --git a/net/socket.c b/net/socket.c
index 24a77400b65e..ffe92ca32f2a 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -1965,8 +1965,9 @@ static int __sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
         * used_address->name_len is initialized to UINT_MAX so that the first
         * destination address never matches.
         */
-        if (used_address && used_address->name_len == msg_sys->msg_namelen &&
+        if (used_address && msg_sys->msg_name &&
-            !memcmp(&used_address->name, msg->msg_name,
+            used_address->name_len == msg_sys->msg_namelen &&
+            !memcmp(&used_address->name, msg_sys->msg_name,
                    used_address->name_len)) {
                err = sock_sendmsg_nosec(sock, msg_sys, total_len);
                goto out_freectl;
@@ -1978,8 +1979,9 @@ static int __sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
         */
        if (used_address && err >= 0) {
                used_address->name_len = msg_sys->msg_namelen;
-                memcpy(&used_address->name, msg->msg_name,
+                if (msg_sys->msg_name)
-                       used_address->name_len);
+                        memcpy(&used_address->name, msg_sys->msg_name,
+                               used_address->name_len);
        }
 out_freectl:
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 645437cfc464..c14865172da7 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -616,6 +616,9 @@ int wiphy_register(struct wiphy *wiphy)
        if (res)
                goto out_rm_dev;
+        rtnl_lock();
+        rdev->wiphy.registered = true;
+        rtnl_unlock();
        return 0;
 out_rm_dev:
@@ -647,6 +650,10 @@ void wiphy_unregister(struct wiphy *wiphy)
 {
        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        rtnl_lock();
+        rdev->wiphy.registered = false;
+        rtnl_unlock();
        rfkill_unregister(rdev->rfkill);
        /* protect the device list */
diff --git a/net/wireless/sysfs.c b/net/wireless/sysfs.c
index c6e4ca6a7d2e..ff574597a854 100644
--- a/net/wireless/sysfs.c
+++ b/net/wireless/sysfs.c
@@ -93,7 +93,8 @@ static int wiphy_suspend(struct device *dev, pm_message_t state)
        if (rdev->ops->suspend) {
                rtnl_lock();
-                ret = rdev->ops->suspend(&rdev->wiphy, rdev->wowlan);
+                if (rdev->wiphy.registered)
+                        ret = rdev->ops->suspend(&rdev->wiphy, rdev->wowlan);
                rtnl_unlock();
        }
@@ -112,7 +113,8 @@ static int wiphy_resume(struct device *dev)
        if (rdev->ops->resume) {
                rtnl_lock();
-                ret = rdev->ops->resume(&rdev->wiphy);
+                if (rdev->wiphy.registered)
+                        ret = rdev->ops->resume(&rdev->wiphy);
                rtnl_unlock();
        }